Reproducible builds | Libcamera about libcamera HOT 5 CLOSED

If you make an implementation, it is certainly worth sharing. : Please see https://libcamera.org/contributing.html

from libcamera.

The public-key implementation is a core detail of libcamera's ability to validate if dynamically loaded IPA modules are supported or not. If they are not signed, they are expected to be sandboxed, and isolated.

This implementation could likely be extended to support externally supplied public and private keys in some form, which would make it 'reproducible'.

from libcamera.

Thanks for your fast reply @kbingham.

It created confusion for me at some point, because I have made more than 4 buildings to check the file differences and still different "signature" in every build. Can be that probably still not reproducible even using the actual pub/priv keys used right now?

I will have a look in how to implement external supplied public and private keys.

Regards

from libcamera.

The private key is generated only once in a given build structure, so if you don't remove the build objects it should stay the same. But if you're building from clean, or in CI it will be a new key each time.
That's why you probably want a mechanism to provide the keys.
Or you could disable the signatures entirely and the modules will all be treated as external

from libcamera.

Understand, thanks for all the information.
I will work on this.

If you think that implementation can be needed in this repository, I could do a PR once is done.

Regards @kbingham

from libcamera.